Hackers Turn Supermarket Freezers Into Ovens: France’s 50°C Cyberattack
Hackers Turn Supermarket Freezers Into Ovens: France’s 50°C Cyberattack
A coordinated attack on connected refrigeration systems disrupted hundreds of French supermarkets, destroying food and exposing dangerous weaknesses in everyday infrastructure.
A Cyberattack Hit France’s Supermarkets Overnight
During the night of October 11–12, 2026, attackers interfered with refrigeration management systems used by several major French supermarket chains.
Instead of maintaining safe temperatures, some refrigerators and freezers were forced into prolonged defrost cycles. The resulting heat damaged large quantities of fresh and frozen food.
French prosecutors confirmed a large-scale cyberattack affecting connected refrigeration equipment and said the damage included food losses and fires.
Prime Minister Sébastien Lecornu instructed France’s national cybersecurity agency, ANSSI, to investigate. Authorities also began coordinating with European counterparts to assess possible wider exposure.
Major Grocery Chains Were Caught in the Attack
Initial reporting identified several major retailers, including Intermarché, Coopérative U, Carrefour, and Monoprix. Other chains were also named in French media reports.
Intermarché
Its parent company reported around 150 affected stores in one early account. Some subsequent reports gave higher figures when including the Netto brand.
Coopérative U
Approximately 100 locations were reported affected. The company’s leadership described the incident as an extraordinary threat to food preservation.
Carrefour
The retailer reported that 80 of its supermarkets were affected by the refrigeration disruption.
Other Retailers
Monoprix confirmed that approximately 5% of its stores were affected. E.Leclerc was also identified in reporting about the attack.
Store counts changed as companies assessed the damage, so the figures should be understood as early reports rather than a final nationwide total.
How Hackers Turned Cooling Systems Into a Destructive Tool
Modern supermarkets use electronic controllers to manage refrigeration across multiple display cases, cold rooms, and freezers.
Some of these systems support remote access so technicians can monitor performance, change settings, and troubleshoot equipment without visiting the store.
According to cybersecurity reporting, the attackers abused this remote-control capability to activate defrost functions and interfere with temperature regulation.
This is an example of an operational technology attack. Operational technology, or OT, refers to systems that monitor and control physical equipment.
Unlike attacks that primarily target digital information, OT incidents can directly affect temperature, machinery, production, transportation, and other real-world processes.
Outdated Refrigeration Software Comes Under Scrutiny
The investigation has focused attention on refrigeration management systems supplied by Danish company Danfoss.
French authorities identified a vulnerability involving software from the manufacturer. Danfoss acknowledged incidents affecting some refrigeration management systems and said the affected units were running outdated firmware.
Firmware is software embedded in hardware. Like applications on a computer, it may require security updates to address weaknesses.
Earlier cybersecurity research had documented vulnerabilities in certain Danfoss refrigeration controllers. However, the precise flaw or access path used in this attack had not been conclusively disclosed at the time of the initial reporting.
Connected equipment can remain in service for many years. If its software stops receiving security updates, known weaknesses may persist even while the physical machinery continues working normally. Organizations need both an inventory of connected devices and a plan for maintaining or replacing them.
Millions in Food Losses and Reports of Fires
The most immediate impact was the loss of temperature-sensitive products.
Refrigerated and frozen goods depend on carefully controlled conditions. Once food warms beyond safe limits, stores may have to discard it even if it appears visually unchanged.
Retailers reported throwing away large quantities of meat, dairy, frozen products, and other perishables.
Intermarché’s leadership warned that nationwide losses could reach tens of millions of euros in a single day. A final verified industry-wide loss figure was not available in the initial reports.
French prosecutors also reported fires associated with the attack. The detailed circumstances and extent of those incidents remained under investigation.
The consequences extend beyond replacement costs. Affected retailers may also face cleanup expenses, equipment inspections, business interruption, and additional food-safety checks.
Could Similar Systems Be Vulnerable Elsewhere?
France began coordinating with other European countries as investigators examined whether the same weakness could affect additional businesses.
A cybersecurity researcher reported possible related effects in Spain, Portugal, Poland, Germany, and Belgium. The full scope and connection between incidents had not yet been independently established.
The concern is understandable. Commercial refrigeration controllers are deployed internationally, and multiple organizations may rely on similar hardware, software, and maintenance providers.
A weakness in widely used connected equipment can therefore create exposure across many otherwise unrelated businesses.
Five Ways Businesses Can Better Protect Connected Equipment
The incident offers important lessons for supermarkets, warehouses, manufacturers, hospitals, and any organization using internet-connected control systems.
Identify devices, software versions, remote access paths, vendors, and equipment that no longer receives security updates.
Avoid exposing industrial controllers directly to the public internet. Use controlled access methods and strong authentication.
Follow manufacturer security guidance, install validated updates, and replace unsupported equipment where practical.
Generate independent alerts when temperatures, operating modes, or controller settings move outside expected limits.
Establish procedures for safely isolating compromised systems, restoring controls, preserving evidence, and protecting perishable inventory.
Cybersecurity Is Now a Physical Safety Issue
When people think about hacking, they often imagine stolen passwords, leaked customer data, or ransomware locking computers.
This incident shows another dimension of cybersecurity: the ability to interfere with systems that directly control the physical world.
Connected technology has made equipment easier to monitor and maintain. It has also expanded the number of pathways that attackers may attempt to exploit.
The same general risk applies to building automation, industrial machinery, energy management, and other systems where software determines how equipment behaves.
For organizations, protecting operational technology is no longer only an IT responsibility. It is also part of business continuity, public safety, and supply-chain resilience.
A Cyberattack Doesn’t Have to Steal Data to Cause Real Damage
The French supermarket attack demonstrates how vulnerable everyday infrastructure can become when connected equipment is not adequately protected. By manipulating refrigeration controls, attackers caused food spoilage, business disruption, and reported fires. The broader lesson extends far beyond grocery stores: organizations must treat connected physical systems as critical security assets, with strong access controls, maintained software, independent monitoring, and reliable recovery procedures. In an increasingly connected world, cybersecurity protects more than information. It protects the systems we rely on every day.